HP-UX Directory Server 8.1 plug-in reference

If the function returns a nonzero value, the server ends the processing of the bind
request. The bind function is responsible for sending the appropriate result code back
to the client before returning a nonzero value.
•
• If the function returns 0, the server continues processing the bind request. The server
sends the [LDAP_SUCCESS] result code back to the client. (The bind function does
not do this.)
11. If the back end bind function succeeds, the server sets the SLAPI_CONN_DN parameter to
the DN, and the SLAPI_CONN_AUTHTYPE parameter to the authentication method.
12. The server sends an [LDAP_SUCCESS] result code back to the client and ends the processing
of the bind request.
If the client's password is due to expire, the server includes a password expiring control
(with the OID 2.16.840.1.113730.3.4.5) as part of the result sent to the client. If the client is
logging in for the first time and needs to change the password, the server includes a
password expired control (with the OID 2.16.840.1.113730.3.4.4) as part of the result sent
to the client.
8.4 Writing your own authentication plug-in
The situation may arise where you want to write and implement your own authentication
function; that is, replace the standard means of authentication with your own function. You can
write a preoperation bind plug-in function (a function that the server calls before processing an
LDAP bind request) that performs the authentication and bypasses the default bind functionality.
This is described in the following section.
8.5 Writing a preoperation bind plug-in
You can define your own preoperation bind plug-in function to authenticate LDAP clients. The
server will call your function during the authentication process. See “How an authentication
request is processed” for more information on the authentication process. Your function should
return a nonzero value to bypass the default back end bind function and the postoperation bind
functions.
This means that the final steps of the authentication process are skipped. Your preoperation
plug-in function is responsible for sending the result code to the client and for setting the DN
and authentication method for the connection.
Figure 8-1 “Using a preoperation bind plug-in function to handle authentication” summarizes
the process of using a preoperation bind plug-in function to authenticate LDAP clients to the
Directory Server.
8.4 Writing your own authentication plug-in 71